Search for packages
| purl | pkg:npm/tough-cookie@2.3.2 |
| Vulnerability | Summary | Fixed by |
|---|---|---|
|
VCID-3buh-pfq7-9kf2
Aliases: GMS-2017-210 |
Regular Expression Denial of Service The `tough-cookie` module is vulnerable to regular expression denial of service. Input of around k characters is required for a slow down of around 2 seconds. Unless node was compiled using the `-DHTTP_MAX_HEADER_SIZE=` option the default header max length is kb so the impact of the ReDoS is limited to around seconds of blocking. |
Affected by 1 other vulnerability. |
|
VCID-am2z-v7gj-nqch
Aliases: CVE-2017-15010 GHSA-g7q5-pjjr-gqvp |
Uncontrolled Resource Consumption An attacker that is able to make an HTTP request using a specially crafted cookie may cause the application to consume an excessive amount of CPU. |
Affected by 1 other vulnerability. |
|
VCID-wjaq-7np6-z3bk
Aliases: CVE-2023-26136 GHSA-72xf-g2v4-qvf3 |
Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') Versions of the package tough-cookie before 4.1.3 is vulnerable to Prototype Pollution due to improper handling of Cookies when using CookieJar in rejectPublicSuffixes=false mode. This issue arises from the manner in which the objects are initialized. |
Affected by 0 other vulnerabilities. |
| Vulnerability | Summary | Aliases |
|---|---|---|
| This package is not known to fix vulnerabilities. | ||